Microsoft AZ-500 Practice Test 54
Question 530
Microsoft Defender for Cloud flags persistent management-port exposure on an eligible VM and suggests time-limited access. A review identifies this consequence: Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. Which remediation most directly restores the intended behavior?
- The controlled remediation is to require approved short access requests and verify ports close again after the window.
- The controlled remediation is to disable management authentication because the access window is short.
- The controlled remediation is to create a permanent global Allow for TCP 22 instead of a timed JIT request.
- The controlled remediation is to assume Azure Bastion and JIT are always identical products.
Explanation
Correct Answer
A:Test using these records: JIT policy, requested access windows, relevant NSG or firewall changes and access logs. JIT access reduces the time sensitive VM management ports remain reachable from allowed sources.
Incorrect Answers
B:Disable management authentication because the access window is short. This would not reliably restore the intended security boundary. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The appropriate controlled recovery is: Require approved short access requests and verify ports close again after the window.
C:Create a permanent global Allow for TCP 22 instead of a timed JIT request. This would not reliably restore the intended security boundary. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The appropriate controlled recovery is: Require approved short access requests and verify ports close again after the window.
D:Assume Azure Bastion and JIT are always identical products. This would not reliably restore the intended security boundary. Leaving RDP or SSH open indefinitely undermines intended temporary access enforcement. The appropriate controlled recovery is: Require approved short access requests and verify ports close again after the window.
Question 531
A Kubernetes control plane should only be accessed from approved private networks but its API server has a public endpoint. Which configuration decision MOST directly resolves the issue?
- Use supported AKS private cluster API access with correct private DNS and authorized network connectivity.
- Add a pod NetworkPolicy and assume it makes the Kubernetes API server private.
- Publish an admin kubeconfig in a public repository so operators can connect.
- Ignore DNS resolution when private endpoint traffic cannot reach the API server.
Explanation
Correct Answer
A:A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Confirm the change against these records: AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
Incorrect Answers
B:That option would add a pod NetworkPolicy and assume it makes the Kubernetes API server private, but it addresses a different concern. A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route.
C:Publish an admin kubeconfig in a public repository so operators can connect. The proposed change targets the wrong mechanism or lacks essential validation. A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Relevant evidence is AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
D:Ignore DNS resolution when private endpoint traffic cannot reach the API server. This leaves the security requirement unresolved. Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The intended action is: Use supported AKS private cluster API access with correct private DNS and authorized network connectivity.
Question 532
A Kubernetes control plane should only be accessed from approved private networks but its API server has a public endpoint. What evidence most directly confirms the intended security behavior?
- An outdated deployment template without current effective settings.
- AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
- A storage account resource name without its encryption or retention configuration.
- The identity name without a corresponding workload data authorization test.
Explanation
Correct Answer
B:These records test the actual AKS private cluster API endpoint behavior rather than an unrelated dashboard state. A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
D:On its own, that evidence does not prove the specified security control works. In the given case, a Kubernetes control plane should only be accessed from approved private networks but its API server has a public endpoint.
Question 533
A Kubernetes control plane should only be accessed from approved private networks but its API server has a public endpoint. Which security principle best explains the intended decision?
- A protected storage account is immune to every accidental deletion and overwrite.
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
- A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route.
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
Explanation
Correct Answer
C:Confirmation depends on AKS private cluster state, API server FQDN resolution, network path and kubectl connection. This principle supports the security response: Use supported AKS private cluster API access with correct private DNS and authorized network connectivity.
Incorrect Answers
A:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for AKS private cluster API endpoint. The relevant security behavior is: A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Check evidence such as AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
B:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for AKS private cluster API endpoint. The relevant security behavior is: A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Check evidence such as AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
D:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for AKS private cluster API endpoint. The relevant security behavior is: A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Check evidence such as AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
Question 534
A Kubernetes control plane should only be accessed from approved private networks but its API server has a public endpoint. Suppose the operator instead follows this unsafe shortcut: Add a pod NetworkPolicy and assume it makes the Kubernetes API server private. Which resulting risk or fault should the reviewer identify?
- Keeping historic blob versions is the cause of the missing RBAC assignment.
- The security flaw is that the team retained a tested database backup.
- Using only Kubernetes RBAC does not remove an unintended public API server endpoint.
- Inspecting encryption settings itself disables a healthy disk.
Explanation
Correct Answer
C:A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real AKS private cluster API endpoint weakness after the shortcut. The material failure is: Using only Kubernetes RBAC does not remove an unintended public API server endpoint.
B:This does not explain the real AKS private cluster API endpoint weakness after the shortcut. Inspect evidence such as AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
D:This does not explain the real AKS private cluster API endpoint weakness after the shortcut. In the given case, a Kubernetes control plane should only be accessed from approved private networks but its API server has a public endpoint.
Question 535
A Kubernetes control plane should only be accessed from approved private networks but its API server has a public endpoint. A review identifies this consequence: Using only Kubernetes RBAC does not remove an unintended public API server endpoint. Which remediation most directly restores the intended behavior?
- Publish an admin kubeconfig in a public repository so operators can connect.
- Ignore DNS resolution when private endpoint traffic cannot reach the API server.
- Add a pod NetworkPolicy and assume it makes the Kubernetes API server private.
- Correct the AKS private endpoint and management DNS path and test authorized API access.
Explanation
Correct Answer
D:A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Publish an admin kubeconfig in a public repository so operators can connect. This would not reliably restore the intended security boundary. Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The appropriate controlled recovery is: Correct the AKS private endpoint and management DNS path and test authorized API access.
B:Ignore DNS resolution when private endpoint traffic cannot reach the API server. This would not reliably restore the intended security boundary. Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The appropriate controlled recovery is: Correct the AKS private endpoint and management DNS path and test authorized API access.
C:That option would add a pod NetworkPolicy and assume it makes the Kubernetes API server private, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
Question 536
A regulated AKS environment needs cluster management through VPN or ExpressRoute without directly exposing the API to the internet. Which operator action best meets this technical requirement?
- For this Azure workload, the team should publish an admin kubeconfig in a public repository so operators can connect.
- For this Azure workload, the team should ignore DNS resolution when private endpoint traffic cannot reach the API server.
- For this Azure workload, the team should add a pod NetworkPolicy and assume it makes the Kubernetes API server private.
- For this Azure workload, the team should use supported AKS private cluster API access with correct private DNS and authorized network connectivity.
Explanation
Correct Answer
D:A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route.
Incorrect Answers
A:Publish an admin kubeconfig in a public repository so operators can connect. The proposed change targets the wrong mechanism or lacks essential validation. A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Relevant evidence is AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
B:Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The intended action is: Use supported AKS private cluster API access with correct private DNS and authorized network connectivity.
C:Using only Kubernetes RBAC does not remove an unintended public API server endpoint. In the given case, a regulated AKS environment needs cluster management through VPN or ExpressRoute without directly exposing the API to the internet.
Question 537
A regulated AKS environment needs cluster management through VPN or ExpressRoute without directly exposing the API to the internet. Which collection of observations most directly tests the suspected cause?
- In this security review, examine AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
- In this security review, examine a database online indicator without a log of the protected operation.
- In this security review, examine an outdated deployment template without current effective settings.
- In this security review, examine a storage account resource name without its encryption or retention configuration.
Explanation
Correct Answer
A:These records test the actual AKS private cluster API endpoint behavior rather than an unrelated dashboard state. The intended action is: Use supported AKS private cluster API access with correct private DNS and authorized network connectivity.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, a regulated AKS environment needs cluster management through VPN or ExpressRoute without directly exposing the API to the internet.
C:A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route.
D:The more relevant observations are: AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
Question 538
A regulated AKS environment needs cluster management through VPN or ExpressRoute without directly exposing the API to the internet. Which statement most accurately explains this scenario?
- The applicable security principle is that a private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route.
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
Explanation
Correct Answer
A:Confirmation depends on AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
Incorrect Answers
B:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for AKS private cluster API endpoint. The relevant security behavior is: A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Check evidence such as AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
C:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for AKS private cluster API endpoint. The relevant security behavior is: A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Check evidence such as AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
D:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for AKS private cluster API endpoint. The relevant security behavior is: A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Check evidence such as AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
Question 539
A regulated AKS environment needs cluster management through VPN or ExpressRoute without directly exposing the API to the internet. Suppose the operator instead follows this unsafe shortcut: Add a pod NetworkPolicy and assume it makes the Kubernetes API server private. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
- The resulting security weakness is that using only Kubernetes RBAC does not remove an unintended public API server endpoint.
- The resulting security weakness is that the observed issue is fully explained by the service display name.
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
Explanation
Correct Answer
B:A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. The suitable control is: Use supported AKS private cluster API access with correct private DNS and authorized network connectivity.
Incorrect Answers
A:This does not explain the real AKS private cluster API endpoint weakness after the shortcut. In the given case, a regulated AKS environment needs cluster management through VPN or ExpressRoute without directly exposing the API to the internet.
C:This does not explain the real AKS private cluster API endpoint weakness after the shortcut. The observed issue is fully explained by the service display name.
D:This does not explain the real AKS private cluster API endpoint weakness after the shortcut. The security flaw is that the team retained a tested database backup.
Question 540
A regulated AKS environment needs cluster management through VPN or ExpressRoute without directly exposing the API to the internet. A review identifies this consequence: Using only Kubernetes RBAC does not remove an unintended public API server endpoint. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to correct the AKS private endpoint and management DNS path and test authorized API access.
- The controlled remediation is to ignore DNS resolution when private endpoint traffic cannot reach the API server.
- The controlled remediation is to add a pod NetworkPolicy and assume it makes the Kubernetes API server private.
- The controlled remediation is to publish an admin kubeconfig in a public repository so operators can connect.
Explanation
Correct Answer
A:A private AKS API endpoint restricts control-plane network exposure while requiring an accessible private management route. Test using these records: AKS private cluster state, API server FQDN resolution, network path and kubectl connection.
Incorrect Answers
B:Ignore DNS resolution when private endpoint traffic cannot reach the API server. This would not reliably restore the intended security boundary. Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The appropriate controlled recovery is: Correct the AKS private endpoint and management DNS path and test authorized API access.
C:Add a pod NetworkPolicy and assume it makes the Kubernetes API server private. This would not reliably restore the intended security boundary. Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The appropriate controlled recovery is: Correct the AKS private endpoint and management DNS path and test authorized API access.
D:Publish an admin kubeconfig in a public repository so operators can connect. This would not reliably restore the intended security boundary. Using only Kubernetes RBAC does not remove an unintended public API server endpoint. The appropriate controlled recovery is: Correct the AKS private endpoint and management DNS path and test authorized API access.
